ByteOS Network

Vulnerability Details :

CVE-2015-1635

Summary

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-14 Apr, 2015 | 20:00

Updated At-22 Oct, 2025 | 00:05

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Known Exploited Vulnerabilities (KEV)

cisa.gov

Vendor:

Microsoft Corporation

Product:HTTP.sys

Added At:10 Feb, 2022

Due At:10 Aug, 2022

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

Used in Ransomware

Unknown

CWE

CWE-94

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2015-1635

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:14 Apr, 2015 | 20:00

Updated At:22 Oct, 2025 | 00:05

▼CVE Numbering Authority (CNA)

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	vendor-advisory x_refsource_MS
https://www.exploit-db.com/exploits/36773/	exploit x_refsource_EXPLOIT-DB
http://www.osvdb.org/120629	vdb-entry x_refsource_OSVDB
http://www.securitytracker.com/id/1032109	vdb-entry x_refsource_SECTRACK
http://www.securityfocus.com/bid/74013	vdb-entry x_refsource_BID
https://www.exploit-db.com/exploits/36776/	exploit x_refsource_EXPLOIT-DB
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	x_refsource_MISC

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: https://www.exploit-db.com/exploits/36773/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: http://www.osvdb.org/120629

Resource:

vdb-entry

x_refsource_OSVDB

Hyperlink: http://www.securitytracker.com/id/1032109

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securityfocus.com/bid/74013

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://www.exploit-db.com/exploits/36776/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	vendor-advisory x_refsource_MS x_transferred
https://www.exploit-db.com/exploits/36773/	exploit x_refsource_EXPLOIT-DB x_transferred
http://www.osvdb.org/120629	vdb-entry x_refsource_OSVDB x_transferred
http://www.securitytracker.com/id/1032109	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securityfocus.com/bid/74013	vdb-entry x_refsource_BID x_transferred
https://www.exploit-db.com/exploits/36776/	exploit x_refsource_EXPLOIT-DB x_transferred
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	x_refsource_MISC x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/36773/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: http://www.osvdb.org/120629

Resource:

vdb-entry

x_refsource_OSVDB

x_transferred

Hyperlink: http://www.securitytracker.com/id/1032109

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securityfocus.com/bid/74013

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/36776/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-02-10

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635

Timeline

Event	Date
CVE-2015-1635 added to CISA KEV	2022-02-10 00:00:00

Event: CVE-2015-1635 added to CISA KEV

Date: 2022-02-10 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635

Resource:

government-resource

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:14 Apr, 2015 | 20:59

Updated At:22 Apr, 2026 | 16:42

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-02-10	2022-08-10	Microsoft HTTP.sys Remote Code Execution Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-02-10

Due Date: 2022-08-10

Vulnerability Name: Microsoft HTTP.sys Remote Code Execution Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov
CWE-94	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-94

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	secure@microsoft.com	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/120629	secure@microsoft.com	Broken Link
http://www.securityfocus.com/bid/74013	secure@microsoft.com	Third Party Advisory VDB Entry Broken Link
http://www.securitytracker.com/id/1032109	secure@microsoft.com	Third Party Advisory VDB Entry Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	secure@microsoft.com	Patch Vendor Advisory
https://www.exploit-db.com/exploits/36773/	secure@microsoft.com	Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/	secure@microsoft.com	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/120629	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securityfocus.com/bid/74013	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry Broken Link
http://www.securitytracker.com/id/1032109	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry Broken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://www.exploit-db.com/exploits/36773/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/36776/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html

Source: secure@microsoft.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: http://www.osvdb.org/120629

Source: secure@microsoft.com

Resource:

Broken Link

Hyperlink: http://www.securityfocus.com/bid/74013

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Broken Link

Hyperlink: http://www.securitytracker.com/id/1032109

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Broken Link

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Hyperlink: https://www.exploit-db.com/exploits/36773/

Source: secure@microsoft.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: https://www.exploit-db.com/exploits/36776/

Source: secure@microsoft.com

Resource:

Exploit

Third Party Advisory

VDB Entry

Hyperlink: http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html